SolarWinds Web Help Desk Hardcoded Credential Vulnerability

This repository contains a proof-of-concept Python exploit for CVE-2024-28987, a hardcoded credential vulnerability in SolarWinds Web Help Desk. The main script, 'cve-2024-28987.py', uses a hardcoded HTTP Basic Authorization header to authenticate to the SolarWinds Web Help Desk API. It retrieves up to 25 of the most recent help desk tickets (due to an API limitation), fetches full details for each ticket, and saves the results in a structured directory format. The script also analyzes ticket IDs to estimate the total number of tickets in the system. Output is organized into JSON files for summaries and detailed ticket data. The exploit is network-based, targeting the API endpoints '/helpdesk/WebObjects/Helpdesk.woa/ra/OrionTickets' and '/helpdesk/WebObjects/Helpdesk.woa/ra/OrionTickets/{ticket_id}' on the victim system. The repository includes a README with usage instructions and a LICENSE file. The exploit does not provide a shell or code execution, but enables unauthorized access to sensitive ticket data via the exposed API.

This repository contains a proof-of-concept exploit for CVE-2024-28987, a hardcoded credential vulnerability in SolarWinds Web Help Desk. The main file, CVE-2024-28987.py, is a Python script that takes a target URL as input and attempts to retrieve helpdesk tickets from the target by sending an HTTP GET request to the /helpdesk/WebObjects/Helpdesk.woa/ra/OrionTickets endpoint. The request uses a hardcoded HTTP Basic Authorization header, exploiting the vulnerability to gain unauthorized access to ticket data. The script prints the retrieved tickets if successful, or indicates if the target is likely not vulnerable. The repository also includes a README.md with usage instructions and background information. No additional payloads or post-exploitation actions are present; the exploit is limited to reading ticket data. The attack vector is network-based, requiring access to the target's web interface.